LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 12-10-2004, 02:04 PM   #1
enzo250gto
Member
 
Registered: Oct 2001
Location: Tokyo, Japan
Distribution: Slackware
Posts: 105

Rep: Reputation: 15
recent attack via phpBB, log files deleted? accessed file system outside /home/


My server was recently attacked by some hackers that used an exploit in php and phpBB's forum software.

In this attack the attacker manager to delete all the files from /var/log in addition they took down apache.

Now for my questions. If the linux user "user1" has a website in /home/user1/www and apache is being run by the "apache" user what user is actually accessing the files when it is http://www.site.blah/forum/ ?

How could this user then begin running things outside the /home/ directory?

I was running RedHat 9.

Thanks for the info.
 
Old 12-10-2004, 03:55 PM   #2
sigsegv
Senior Member
 
Registered: Nov 2004
Location: Third rock from the Sun
Distribution: NetBSD-2, FreeBSD-5.4, OpenBSD-3.[67], RHEL[34], OSX 10.4.1
Posts: 1,197

Rep: Reputation: 47
Apache runs as "apache". Chances are the attecker used the phpBB hole to gain access to the system, then used a local exploit to gain higher access. Generally speaking, people tend to ignore local exploits thinking "My listening daemons are secure, so I don't have to worry about that" ...

This is a good example of why that's not true.
 
Old 12-13-2004, 12:00 PM   #3
enzo250gto
Member
 
Registered: Oct 2001
Location: Tokyo, Japan
Distribution: Slackware
Posts: 105

Original Poster
Rep: Reputation: 15
Quote:
Originally posted by sigsegv
Apache runs as "apache". Chances are the attecker used the phpBB hole to gain access to the system, then used a local exploit to gain higher access. Generally speaking, people tend to ignore local exploits thinking "My listening daemons are secure, so I don't have to worry about that" ...

This is a good example of why that's not true.
I agree 100% and this is my question. How do I know the local exploits? Once I acknowledge the local exploits how to I plug them up?

Perhaps I need to read a Linux security book?
 
Old 12-13-2004, 03:49 PM   #4
sigsegv
Senior Member
 
Registered: Nov 2004
Location: Third rock from the Sun
Distribution: NetBSD-2, FreeBSD-5.4, OpenBSD-3.[67], RHEL[34], OSX 10.4.1
Posts: 1,197

Rep: Reputation: 47
While that's a good idea too, you should mostly just watch your distro's security mailing list to see when holes are discovered (I have no idea if Slack has such a thing -- Not used it since v3). Another good list to watch is Bugtraq, or PacketStorm.

Last edited by sigsegv; 12-13-2004 at 03:50 PM.
 
Old 12-13-2004, 06:58 PM   #5
tangle
Senior Member
 
Registered: Apr 2002
Location: Arbovale, WV
Distribution: Slackware
Posts: 1,758

Rep: Reputation: 77
Here is Slack's office security advisories.
http://www.slackware.com/security/li...ecurity&y=2004

Since Pat is really sick, there are a couple of guys from Brazil that he trusts that are doing security updates. Look here for them.
http://www.slackware.org.br/~patrick...-ChangeLog.txt
 
Old 12-17-2004, 12:49 PM   #6
cormander
Member
 
Registered: Dec 2004
Location: Hawaii
Distribution: Fedora & CentOS
Posts: 72

Rep: Reputation: 15
What I always recomend is a very tight firewall. What hackers like to do, is try to retrieve a backdoor program they can telnet or ssh into. If you're filtering all ports not in use, then they can't do this.

Also, if you reject certian types of outgoing requests, they can't retrieve a hacker program at all. I have a deny-by-default policy, on both incoming and outgoing, and so far, for outgoing, I only have enabled udp to certian IP addresses on port 53 ( my DNS servers ), and port 25 ( to be able to send mail ).

If they try to retrieve something, they will get:

Code:
[corman@localhost corman]$ wget cormander.com
--10:35:30--  http://cormander.com/
           => `index.html'
Resolving cormander.com... done.
Connecting to cormander.com[68.157.128.141]:80... failed: Connection refused.
[corman@localhost corman]$
Also, it is a good idea to symlink /usr/tmp, /var/tmp, and any other world writable directory to /tmp. This makes a single place to look at for hacker-made files. Have a cronjob running, that checks for executable files in /tmp, and alerts you, because you should never have an executable file in there.

-Corey
 
Old 12-17-2004, 01:33 PM   #7
sigsegv
Senior Member
 
Registered: Nov 2004
Location: Third rock from the Sun
Distribution: NetBSD-2, FreeBSD-5.4, OpenBSD-3.[67], RHEL[34], OSX 10.4.1
Posts: 1,197

Rep: Reputation: 47
Quote:
Originally posted by cormander
What I always recomend is a very tight firewall. What hackers like to do, is try to retrieve a backdoor program they can telnet or ssh into. If you're filtering all ports not in use, then they can't do this.
This isn't true, but is a good idea anyway

Quote:
Originally posted by cormander
If they try to retrieve something, they will get:
Unless they run their rootkit server on tcp 25 of course

Quote:
Originally posted by cormander
... that checks for executable files in /tmp, and alerts you, because you should never have an executable file in there.
This isn't true either, though also not a bad idea. What you should do instead is mount /tmp (and pretty much everything besides /usr) noexec. This is also a nice example of why the all to common trend among Linux distros to put entire fs under one big all encompassing '/' is a stupid idea.
 
Old 12-17-2004, 01:43 PM   #8
cormander
Member
 
Registered: Dec 2004
Location: Hawaii
Distribution: Fedora & CentOS
Posts: 72

Rep: Reputation: 15
Security isn't about having "true" fixes to hack methods, it's about taking more steps to prevent them then the hackers are able to try.

Haven't considered the mounted no-exec before, however. How exactly do you do that? Would I have to create a whole new partition and mount it to /tmp ?

-Corey
 
Old 12-17-2004, 01:51 PM   #9
sigsegv
Senior Member
 
Registered: Nov 2004
Location: Third rock from the Sun
Distribution: NetBSD-2, FreeBSD-5.4, OpenBSD-3.[67], RHEL[34], OSX 10.4.1
Posts: 1,197

Rep: Reputation: 47
Quote:
Originally posted by cormander
Security isn't about having "true" fixes to hack methods, it's about taking more steps to prevent them then the hackers are able to try.


Quote:
Originally posted by cormander
Haven't considered the mounted no-exec before, however. How exactly do you do that? Would I have to create a whole new partition and mount it to /tmp ?
man mount
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Deleted /var/log/messages, can't log any files-iptables chingyenccy Linux - Newbie 7 02-27-2005 04:03 PM
user home directorys can't be accessed anymore r_squared Linux - General 1 01-04-2005 08:35 PM
I've deleted a log file to save space and... ganninu Linux - General 3 11-04-2003 12:03 PM
Tracking the accessed files EdwinNameless Linux - Software 5 07-16-2003 11:00 AM
Log Files Have Been Deleted Crashed_Again Linux - Security 4 02-02-2003 12:37 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 12:27 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration